Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-6r7x-6q98-qcqp
Advisory ID github_osv/GHSA-6r7x-6q98-qcqp
Aliases CVE-2015-3174
Summary Moodle does not set the RISK_XSS bit for graders mod/quiz/db/access.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 does not set the RISK_XSS bit for graders, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted gradebook feedback during manual quiz grading.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
System Score Found at
generic_textual LOW
Reference id Reference type URL
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-49941
http://openwall.com/lists/oss-security/2015/05/18/1
https://github.com/moodle/moodle
https://github.com/moodle/moodle/commit/10c2b92448873a8479942098a090e7c16b44438d
https://github.com/moodle/moodle/commit/1ce4f44df7e793051211841b6a78ac77bd42fc99
https://github.com/moodle/moodle/commit/39ae18a2f90fcf392a711dd41f9aa7627f72a762
https://github.com/moodle/moodle/commit/e51fdfe0cbab19320f139773d83aacb1ad15eb46
https://moodle.org/mod/forum/discuss.php?d=313681
https://web.archive.org/web/20201030042703/http://www.securitytracker.com/id/1032358
http://www.securityfocus.com/bid/74719https://web.archive.org/web/20200228054910/http://www.securityfocus.com/bid/74719
CVE-2015-3174 https://nvd.nist.gov/vuln/detail/CVE-2015-3174
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

There are no SSVC decisions available.